Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' C:\Seng\exle1.dll
- '<SYSTEM32>\regsvr32.exe' C:\Seng\exle2.dll
Network activity
Connects to
- 'tc####rceshop.com':443
- 'pk#.goog':80
- 'dc####oes.com.br':443
- 'x1.#.lencr.org':80
- 'x2.#.lencr.org':80
- 'co####otos.com.br':443
TCP
HTTP GET requests
- http://pk#.goog/gsr1/gsr1.crt
- http://x1.#.lencr.org/
- http://x2.#.lencr.org/
Other
- 'tc####rceshop.com':443
- 'dc####oes.com.br':443
- 'co####otos.com.br':443
UDP
- DNS ASK tc####rceshop.com
- DNS ASK pk#.goog
- DNS ASK dc####oes.com.br
- DNS ASK x1.#.lencr.org
- DNS ASK x2.#.lencr.org
- DNS ASK co####otos.com.br
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' C:\Seng\exle1.dll' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Seng\exle2.dll' (with hidden window)
